release aidev BREAKING SIG 3/5

Hermes Agent v0.15.1: dashboard reload-loop hotfix, Docker --insecure now explicit

Same-day hotfix for v0.15.0. The headline fix stops the dashboard full-page reload loop that hit every loopback-mode install (Docker, hosted, fresh installs), where a by-design 401 from /api/auth/me was mistaken for a rotated session token. Docker users who relied on --insecure being inferred from a non-loopback bind host must now set HERMES_DASHBOARD_INSECURE=1 explicitly — that is a required action, not a default carry-over.

PUBLISHED2026-05-29
OBSERVED2026-08-11
AGE2mo
SOURCES1
  • Dashboard: fetchJSON gains an allowUnauthorized opt-out that skips the loopback stale-token reload; 401 still throws so AuthWidget swallows it and gated-mode login_url redirects are unaffected. Closes #34206, #34202 (#30698)
  • Docker: --insecure is no longer inferred from a non-loopback bind host; disabling the dashboard's loopback auth requires HERMES_DASHBOARD_INSECURE=1. Existing setups that wanted insecure binding must set the env var (#34188, #34204)
  • MCP: bare npx/npm/node commands resolve against /usr/local/bin so MCP servers launch inside the Docker image (#34186)
  • Dashboard: skills page source pills and category sidebar restored (stale useMemo dependency) (#34194)
  • Skills hub: catalog fetch walks the sitemap, surfacing all 19,932 skills.sh entries instead of the first 858 (#34025)
  • Kanban: worker SIGTERM actually terminates the process (#34045); workers receive images referenced in task bodies for vision-capable models (#34210)
  • Gateway: .md files deliver again — media-delivery validation is denylist-only instead of a narrow allowlist (#34022); no model stepdown on context overflow when the provider context limit is unknown (#33826)
  • CLI: /yolo mid-session enables the per-session bypass instead of only toggling the already-snapshotted env var (#33931); /model and hermes model show the same list, with a disk cache for picker startup (#33867)
  • Build: arm64 PR builds skip the GHA cache (#33704)
  • Scope: 28 commits, 21 merged PRs, 9 contributors since v0.15.0
fixbreakingsecurity

COMMUNITY

No curated reactions recorded for this event. Facts and takes are kept in separate layers — community context is added by hand, never blended into the record above.